SNMP

ITE 3304
What is SNMP ?
■
SNMP – Simple Network Management Protocol
●
Industry standard, hundreds of tools exist to exploit it
●
Present on any decent network equipment
■
Query – response based
●
GET / SET
 Mostly GET is used for monitoring
■
Tree hierarchy
●
Query for ”Object Identifiers” (OIDs)
■
Concept of MIBs (Management Information Base)
●
Standard and vendor-specific (Enterprise)
What is SNMP ?
■
UDP protocol, port 161
■
Different versions
●
Originally, 1988
●
v1 – RFC1155, RFC1156, RFC1157

Original specification
●
v2 – RFC1901 ... RFC1908 + RFC2578

Extends v1, new data types, better retrieval methods (GETBULK)

Really is version v2c (without security model)
●
v3 – RFC3411 ... RFC3418
■
Typically we use SNMPv2
■
Terminology:
●
Manager (the monitoring ”client”)
●
Agent (running on the equipment/server)
What is SNMP ?
■
Typical queries
●
Bytes In/Out on an interface, errors
●
CPU load
●
Uptime
●
Temperature
●
...
■
For hosts (servers or workstations)
●
Diskspace
●
Installed software
●
Running processes
●
...
■
Windows and UNIX have SNMP
How does it work ?

■
Basic commands
●
GET (manager -> agent)

Query for a value
●
GET-NEXT (manager -> agent)

Get next value (list of values for a table)
●
GET-RESPONSE (agent -> manager)

Response to GET/SET, or error
●
SET (manager -> agent)

Set a value, or perform action
●
TRAP (agent -> manager)

Spontaneous notification from equipment (line down,
temperature above threshold, ...)
MIB

• Management Information Base (MIB) is

a type of database
• It used for managing the devices in a
communications network.
• It comprises a collection of objects in a
(virtual) database used to manage entities
(such as routers and switches) in a
network.
SNMP & MIB

• SNMP makes use of MIBs

• SNMP uses a specified set of commands
and queries to access MIB
• MIB should contain information on these
commands and on the target objects
(controllable entities or potential sources
of status information) with a view to tuning
the network transport to the current needs.
SNMP Queries
■
Some typical commands for querying:
●
snmpget
●
snmpwalk
●
snmpstatus

■
Examples
●
snmpstatus -c pacn0g2k9 -v1
192.168.1.221
●
snmpget -c pacn0g2k9 -v1
192.168.1.223
.iso.org.dod.internet.mgmt.mib-
2.interfaces.ifNumber.0
SNMP Query Format

snmpstatus -c pacn0g2k9 -v1 192.168.1.221

SNMP Query Node

SNMP Version
■
Community:
●
A ”security” string (password) to define whether the
querying manager will have RO (read only) or RW
(read write) access
●
This is the simplest form of authentication in SNMP
More References

• http://www.snmplink.org